OESA-2022-2062

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2062
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2022-2062.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2022-2062
Upstream
Published
2022-11-11T11:04:32Z
Modified
2025-08-12T05:04:09.641194Z
Summary
kafka security update
Details

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications.

Security Fix(es):

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.(CVE-2019-12399)

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.(CVE-2022-34917)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / kafka

Package

Name
kafka
Purl
pkg:rpm/openEuler/kafka&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8.2-1.oe1

Ecosystem specific 

{
    "src": [
        "kafka-2.8.2-1.oe1.src.rpm"
    ],
    "x86_64": [
        "kafka-2.8.2-1.oe1.x86_64.rpm"
    ],
    "aarch64": [
        "kafka-2.8.2-1.oe1.aarch64.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / kafka

Package

Name
kafka
Purl
pkg:rpm/openEuler/kafka&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8.2-1.oe1

Ecosystem specific 

{
    "src": [
        "kafka-2.8.2-1.oe1.src.rpm"
    ],
    "x86_64": [
        "kafka-2.8.2-1.oe1.x86_64.rpm"
    ],
    "aarch64": [
        "kafka-2.8.2-1.oe1.aarch64.rpm"
    ]
}

openEuler:22.03-LTS / kafka

Package

Name
kafka
Purl
pkg:rpm/openEuler/kafka&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8.2-1.oe2203

Ecosystem specific 

{
    "src": [
        "kafka-2.8.2-1.oe2203.src.rpm"
    ],
    "x86_64": [
        "kafka-2.8.2-1.oe2203.x86_64.rpm"
    ],
    "aarch64": [
        "kafka-2.8.2-1.oe2203.aarch64.rpm"
    ]
}